CVE-2026-96425Medium· 5.5▾ SunlitIncorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus
lomiri-download-manager >= 0.1.0 < 0.3.3Upgrade lomiri-download-manager to 0.3.3, or obtain patched version from your distro. If running Ubuntu Touch, fixed versions are included in Ubuntu Touch 24.04-2.1 and 24.04-1.5.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96424High· 7.8Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
CVE-2025-54546High· 7.5On affected platforms, restricted users could use SSH port forwarding to access host-internal services
CVE-2025-54545High· 7.8On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.
CVE-2025-43470Medium· 5.5A permissions issue was addressed with additional restrictions
CVE-2026-10840High· 7.1A flaw was found in the OpenShift Pipelines operator
CVE-2026-92228Medium· 6.5Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read